SaveMyCert
Log in
5 of 5 free questions left today·for 30 a day
CCSP · Domain 4

Cloud Application Security practice questions

Cloud Application Security is worth 16% of the CCSP exam — the 5th-heaviest of the 6 domains. Application security awareness, the secure SDLC, cloud software assurance and validation, verified secure software, cloud application architecture, and IAM solutions. Official weighting 16%. 6 fully worked examples are further down this page, answers included.

Exam weight
16%
the 5th-heaviest of the 6 domains
Questions
245
across 7 topics
Free, no account
5/day
a free account allows 30 a day
Explanations
Every option
right and wrong

Build a practice session

5 free questions left today.

Domains

How many?

Mode

Ready when you are

10 fresh questions drawn across 1 of 6 domains, in Learn mode.

Focused review

Every question you answer incorrectly, and every question you flag while practising, is saved here automatically. Finish a session and you can come back to re-drill just those.

6 sample Cloud Application Security questions, fully explained

Questions from the CCSP bank mapped to domain 4, with the answer key and the reasoning behind every option. None of them repeat the examples on the main CCSP practice page.

Question 1Cloud Application Security

A CISO wants the contract with a new SaaS vendor to require that the vendor's application is "certified compliant with the OWASP Top 10". As the cloud security professional advising on the contract, what is the BEST recommendation?

Choose one.

  • a
    Keep the clause, since the Top 10 is the accepted minimum standard that vendors can be certified against

    There is no Top 10 certification; OWASP describes the Top 10 as an awareness document, so a clause built on it cannot be measured.

  • b
    Replace the clause with independent verification of the application against an agreed ASVS level Correct

    ASVS provides specific, testable requirements, and an agreed level sets how deep the verification goes, which a contract can measure.

  • c
    Require the vendor's SOC 2 Type II report to show the Top 10 as a tested control objective for the service

    SOC 2 reports test controls against the Trust Services Criteria; asking an auditor to attest to an awareness list does not create a verifiable requirement.

  • d
    Require an annual penetration test whose scope and report are limited to the ten Top 10 categories

    Testing is useful, but limiting it to ten broad categories leaves requirements undefined and misses risks outside the list.

The concept

The OWASP Top 10 is an awareness document; contractual and verification requirements need a standard with testable requirements.

Why that’s the answer

OWASP intends the Top 10 to raise awareness of the most critical risk categories, and there is no certification against it. A contract needs a measurable obligation, which ASVS provides: specific requirements at a chosen level that an independent tester can verify. A SOC 2 report attests to the vendor's controls against the Trust Services Criteria, not to an OWASP list, and a penetration test scoped only to ten categories is narrower than the requirement the CISO is after.

How to reason it out
  1. Recognise that the clause names an awareness list as if it were a standard.
  2. Ask what a contract needs: an obligation that can be verified.
  3. Pick the option that substitutes testable requirements and an agreed assurance level.
  4. Reject options that keep the Top 10 as the yardstick in another wrapper.

Exam tip: Nobody is certified against the OWASP Top 10; contract for ASVS verification instead.

CCSP Application Security Awareness: Cloud Development Basics, Pitfalls and the OWASP, API, LLM and CWE Top Lists — the lesson that teaches this.

Question 2Cloud Application Security

A tester signed in as one customer of a cloud billing portal changes the invoice number in the page address and the portal displays another customer's invoice. Which OWASP Top 10:2025 category does this finding BEST fit?

Choose one.

  • a
    Broken Access Control Correct

    Returning another user's record by changing an identifier is an insecure direct object reference, a classic Broken Access Control flaw.

  • b
    Authentication Failures

    The tester was properly authenticated; the flaw is what the portal lets an authenticated user reach.

  • c
    Injection

    No input is interpreted as code or a query command; a valid identifier is simply not authorised.

  • d
    Insecure Design

    Insecure Design covers missing or flawed design-level controls; a missing per-record authorization check is classified as Broken Access Control.

The concept

Broken Access Control (A01:2025) covers users acting outside their intended permissions, including insecure direct object references.

Why that’s the answer

The user is who they claim to be, so authentication worked. What failed is the check that this user may see this invoice. Accessing another account's data by modifying an identifier is the textbook insecure direct object reference that OWASP lists under Broken Access Control, the top-ranked category in 2025.

How to reason it out
  1. Confirm that the user was authenticated correctly.
  2. Identify the missing check: whether this user owns the record.
  3. Map record-level authorization failures to Broken Access Control.

Exam tip: Authenticated but able to see someone else's record = Broken Access Control.

CCSP Application Security Awareness: Cloud Development Basics, Pitfalls and the OWASP, API, LLM and CWE Top Lists — the lesson that teaches this.

Question 3Cloud Application Security

A cloud-hosted app fetches profile images from URLs that users supply. An attacker submits the address of the instance metadata service and receives temporary credentials in the response. A developer course maps findings to the OWASP Top 10:2025. Under which category is this weakness listed?

Choose one.

  • a
    Injection

    The URL is not interpreted as code or a query; the server is made to send a request to an unintended destination.

  • b
    Security Misconfiguration

    Hardening the metadata service reduces impact, but the weakness in the code, server-side request forgery, is mapped elsewhere.

  • c
    Software or Data Integrity Failures

    This category concerns unverified code, updates and serialized data, not a server fetching attacker-chosen URLs.

  • d
    Broken Access Control Correct

    In the 2025 edition, server-side request forgery (CWE-918) was folded into Broken Access Control rather than kept as its own category.

The concept

Server-side request forgery (SSRF) makes a server send requests to destinations the attacker chooses, such as internal metadata endpoints.

Why that’s the answer

The flaw is SSRF: the application fetches an attacker-chosen URL from inside the cloud network. SSRF was a separate category (A10) in the 2021 Top 10, but the 2025 edition maps CWE-918 into A01 Broken Access Control. Security Misconfiguration is tempting because metadata hardening would limit the damage, but the coding weakness itself is SSRF, and it is not an injection of code or commands.

How to reason it out
  1. Recognise the pattern: the server fetches a user-supplied URL and reaches an internal endpoint.
  2. Name the weakness: server-side request forgery.
  3. Recall that the 2025 Top 10 merged SSRF into Broken Access Control.
  4. Separate the code flaw from configuration controls that only limit impact.

Exam tip: Top 10:2025 has no separate SSRF category; it sits under Broken Access Control.

CCSP Application Security Awareness: Cloud Development Basics, Pitfalls and the OWASP, API, LLM and CWE Top Lists — the lesson that teaches this.

Question 4Cloud Application Security

During testing, a team set its IaaS storage container of customer exports to allow anonymous reads, and nobody reverted the setting before go-live. Anyone holding a file's link can now download it. Which OWASP Top 10:2025 category does OWASP use for this kind of flaw?

Choose one.

  • a
    Broken Access Control

    Data is exposed to unauthorised users, but OWASP lists improperly configured cloud service permissions under Security Misconfiguration.

  • b
    Cryptographic Failures

    Encryption at rest would not stop an anonymous read that the service is configured to allow.

  • c
    Security Logging and Alerting Failures

    Alerting on public access would help someone notice the exposure, but the flaw that exposes the files is the permission setting.

  • d
    Security Misconfiguration Correct

    OWASP names improperly configured permissions on cloud services, including open storage, as Security Misconfiguration (A02:2025).

The concept

Security Misconfiguration (A02:2025) covers insecure settings, defaults and unreviewed cloud permissions.

Why that’s the answer

The application code enforces nothing wrong here: a storage setting was left permissive. OWASP's description of Security Misconfiguration explicitly includes improperly configured permissions on cloud services and tells teams to review cloud storage permissions. Broken Access Control is the tempting answer because the result is unauthorised access, but that category covers authorization logic in the application. Encryption at rest does not help when the service itself serves the files to anyone.

How to reason it out
  1. Locate the cause: a service setting, not application logic.
  2. Recall that OWASP lists cloud permission errors as a misconfiguration.
  3. Discard categories that describe the impact rather than the cause.

Exam tip: Open cloud storage left over from testing is Security Misconfiguration, now ranked second.

CCSP Application Security Awareness: Cloud Development Basics, Pitfalls and the OWASP, API, LLM and CWE Top Lists — the lesson that teaches this.

Question 5Cloud Application Security

An attacker takes over a maintainer's account for a popular open-source package and publishes a malicious release. A company's build pipeline, which installs the newest version of each dependency, ships it to production. Which OWASP Top 10:2025 category BEST fits?

Choose one.

  • a
    Software Supply Chain Failures Correct

    A compromised upstream component pulled in through the build process is the core case of A03:2025 Software Supply Chain Failures.

  • b
    Software or Data Integrity Failures

    A08 focuses on integrity checks of code and data at a lower level, such as serialized objects; the attack here entered through the dependency chain.

  • c
    Security Misconfiguration

    Unpinned versions are a pipeline weakness, but the category built for compromised third-party components is a different one.

  • d
    Insecure Design

    Insecure Design covers missing design-level controls in the application itself, not a poisoned third-party release.

The concept

The 2025 Top 10 added Software Supply Chain Failures (A03), broadening the old "vulnerable and outdated components" category.

Why that’s the answer

The application was compromised through a component it trusted and the build system that pulled it in. OWASP's 2025 edition created Software Supply Chain Failures for exactly this: compromised dependencies, build systems and distribution channels. Software or Data Integrity Failures is the near-twin, but OWASP frames it as integrity verification at a lower level than the supply chain, for example unsigned updates or tampered serialized data.

How to reason it out
  1. Trace where the malicious code entered: an upstream package.
  2. Recall the 2025 category for compromised dependencies and build systems.
  3. Distinguish it from lower-level integrity failures such as deserialization.

Exam tip: Poisoned dependency through the pipeline = Software Supply Chain Failures (A03:2025).

CCSP Application Security Awareness: Cloud Development Basics, Pitfalls and the OWASP, API, LLM and CWE Top Lists — the lesson that teaches this.

Question 6Cloud Application Security

A web application stores the user's session state as a serialized object in a browser cookie and deserializes it on each request without checking a signature. A tester edits the cookie to escalate privileges. Which OWASP Top 10:2025 category does this BEST fit?

Choose one.

  • a
    Software Supply Chain Failures

    No third-party component or build step is involved; the untrusted data comes from the client.

  • b
    Mishandling of Exceptional Conditions

    No error path is involved; the server processes the tampered object successfully because it never verifies it.

  • c
    Authentication Failures

    The session mechanism is abused, but the root cause is trusting unverified serialized data.

  • d
    Software or Data Integrity Failures Correct

    Deserializing client-controlled data without verifying its integrity is mapped to A08 (CWE-502 is one of its CWEs).

The concept

Software or Data Integrity Failures (A08:2025) covers code and data whose integrity is assumed rather than verified, including insecure deserialization.

Why that’s the answer

The server trusts an object that the client can see and modify. OWASP maps deserialization of untrusted data (CWE-502) to Software or Data Integrity Failures, and the fix is to verify integrity, for example with a signature, or not to accept serialized objects from untrusted sources. It is not a supply-chain issue because the tampered data comes from the browser, not from a dependency.

How to reason it out
  1. Identify what the server trusts without checking: a client-side serialized object.
  2. Recall that insecure deserialization maps to Software or Data Integrity Failures.
  3. Rule out supply chain, since no third-party code is involved.

Exam tip: Trusting serialized data the client can edit is an integrity failure (A08).

CCSP Application Security Awareness: Cloud Development Basics, Pitfalls and the OWASP, API, LLM and CWE Top Lists — the lesson that teaches this.

What CCSP domain 4 tests, topic by topic

The official exam guide breaks Cloud Application Security into 7 topics. The question bank follows the same split, so a weak topic shows up as a cluster of misses you can go back and read.

Published CCSP practice questions per topic in Cloud Application Security
TopicWhat it coversQuestions
Advocate training and awareness for application securityOfficial CCSP sub-domain 4.1 (Aug-2026 outline): Cloud development basics; Common pitfalls; Common cloud vulnerabilities (e.g., Open Web Application Security Project (OWASP) Top-10, Application Security Verification Standard (ASVS), Top 10 Application Programming Interface (API), Top 10 for Large Language Model Applications, SANS Top-25).35
Describe the Secure Software Development Life Cycle (SDLC) processOfficial CCSP sub-domain 4.2 (Aug-2026 outline): Business requirements; Phases and methodologies (e.g., design, code, test, maintain, waterfall vs. agile).35
Apply the Secure Software Development Life Cycle (SDLC)Official CCSP sub-domain 4.3 (Aug-2026 outline): Cloud-specific risks (e.g., shared technology issues, Cloud Service Provider (CSP) insider threats, lack of visibility and control, legal and jurisdiction issues); Threat modeling; Avoid common vulnerabilities during development; Secure coding (e.g., Open Web Application Security Project (OWASP) Application Security Verification Standard (ASVS), Software Assurance Forum for Excellence in Code (SAFECode)); Software Configuration Management (CM) and versioning.35
Apply cloud software assurance and validationOfficial CCSP sub-domain 4.4 (Aug-2026 outline): Functional and non-functional testing (e.g., Continuous Integration And Continuous Delivery (CI/CD) processes); Security testing methodologies (e.g., blackbox, whitebox, Software Composition Analysis (SCA), Interactive Application Security Testing (IAST), Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST)); Quality assurance (QA); Abuse case testing.35
Use verified secure softwareOfficial CCSP sub-domain 4.5 (Aug-2026 outline): Securing Application Programming Interfaces (API); Supply-chain management (e.g., vendor assessment, integrity, authenticity, licensing); Third-party software management; Validated open-source software.35
Comprehend and apply the specifics of cloud application architectureOfficial CCSP sub-domain 4.6 (Aug-2026 outline): Supplemental security components (e.g., Web Application Firewall (WAF), Database Activity Monitoring (DAM), Extensible Markup Language (XML) firewalls, Application Programming Interface (API) gateway, load balancer); Cryptography; Sandboxing; Application virtualization and orchestration (e.g., microservices, containers, docker, Kubernetes).35
Design appropriate Identity and Access Management (IAM) solutionsOfficial CCSP sub-domain 4.7 (Aug-2026 outline): Federated identity; Identity Providers (IdP); Single Sign-On (SSO); Multi-Factor Authentication (MFA); Cloud Access Security Broker (CASB); Secrets, key, and certificate management.35
Total245

Revise Cloud Application Security before you drill it

CCSP Application Security Awareness: Cloud Development Basics, Pitfalls and the OWASP, API, LLM and CWE Top ListsQuestions on this topic are mostly short scenarios that describe a finding — a tester changing an identifier, an open storage container, a crafted email, a flood of prompts — and ask which category of the OWASP Top 10:2025, the OWASP API Security Top 10 (2023) or the OWASP Top 10 for LLM Applications (2025) it fits. The options are neighbouring categories, so you need the precise boundaries between them and the habit of classifying by root cause rather than consequence. Other items ask what each list is for (awareness, verification or weakness ranking), how the CWE Top 25 is scored, how an ASVS level is chosen, which tasks a development team keeps in a given service model, which migration pitfall is the main security risk, and what to do FIRST or BEST when designing developer awareness training.CCSP Secure SDLC: Business Requirements, Phases, Waterfall vs. Agile and DevSecOpsQuestions on this topic are short definition items and business scenarios. Definition items ask which description matches a methodology (waterfall, spiral, V-model), which V-model test level pairs with a phase, or which NIST SSDF practice group covers an activity. Scenario items describe a project and ask where security should begin, which SDLC failure is the root cause of a defect, who should state data sensitivity, which draft statement is a proper requirement, or what to do FIRST, BEST or NEXT. Expect phase-matching: the control offered must belong to the phase described (design review in design, peer review in coding, requirements-based tests in testing), and options that are real controls in the wrong phase, from the wrong party or too late are the usual alternatives. Other scenarios cover handling a late requirement in waterfall or agile, choosing a methodology for fixed or changing requirements under regulatory evidence needs, DevSecOps ownership and check tiering, reassessment when data changes, disposal order with legal hold, and SDLC ownership across IaaS, PaaS and SaaS.CCSP Applying the Secure SDLC: Cloud Risks, Threat Modeling and Secure CodingQuestions on this topic mix short recall items with design scenarios. Recall items ask what a STRIDE category means or which property it violates, which model rates threats rather than finding them, the order of ATASM's steps, PASTA's starting and finishing stages, what ASVS levels require and what ASVS or SAFECode is for. Scenario items describe a multitenant data layer, cache or queue, a provider-insider concern, a missing audit trail behind a shared service identity, a residency rule or a foreign provider, and ask for the design decision that addresses the stated risk under a stated constraint (keep caching, allow provider troubleshooting, no per-tenant infrastructure). Development items present injection, SSRF or a committed secret and ask for the root-cause fix or the right immediate step, while configuration management items turn on preventing unrecorded changes and rebuilding an old release exactly.CCSP: Cloud Software Assurance and Security Testing (SAST, DAST, IAST, SCA)Expect short recall items that name a testing method, a box or a test type from a description of what it examines or what the tester starts with, classify tests as functional or non-functional, tell an abuse case apart from other kinds of test, or describe what QA is for. Scenario items give a goal and a constraint, such as what the tester has access to, what the pipeline must achieve or what the provider permits, and ask which method or pipeline placement fits, why a result was thin or a flaw was missed, or what the cloud security professional should recommend first. Others turn on gate design, dependency and licence risk, test-environment data, and the scope of customer testing under each service model. Harder items combine two facts, typically a testing principle with a governance one such as independence, traceability, risk acceptance or the shared-responsibility split.CCSP Verified Secure Software: API Security, Software Supply Chain and Open SourceQuestions on this topic mix short recall items with applied scenarios. Recall items describe an artifact or standard (an inventory of components, a supplier-relationship standard, a licence obligation) and offer close neighbours as options. Scenario items describe an incident or design constraint, such as a credential found in logs, a caller reading another tenant's data, a compromised download server, a malicious package entering a build, a licence change on migration or an end-of-support date, and ask for the control that fixes the root cause, the evidence that answers a question fastest, or what to do first. Every option is usually a real control; the right one is the control whose guarantee matches what the scenario needs proved, applied by the right party at the right point in the process.CCSP Cloud Application Architecture: WAF, Sandboxing and KubernetesQuestions on 4.6 are mostly scenarios that describe an application architecture and a specific risk or requirement, then offer several real components or configurations. The deciding detail is usually the layer (network, HTTP content, XML message, database session, field), who controls the control (the administrators being watched, the provider, the security team), whether the control enforces or only observes, and where TLS terminates. Kubernetes and container items test the secure alternative to an open default: token mounting, Secrets encoding, open pod networking, the removal of PodSecurityPolicy, privileged containers and mutable image tags. Expect short definition items that separate neighbouring components (WAF, DAM, XML firewall, sandboxing, application virtualization), and no provider product names: answers are described generically.CCSP Cloud IAM Design: Federation, SSO, MFA, CASB and Secrets ManagementQuestions on this topic mix short recall items with design scenarios. Recall items ask which party issues an assertion, which standard fits delegated access, what verifies an assertion's origin, why two checks are not MFA, or what a CASB is, with sibling terms as options. Scenario items describe a cloud application with a stated constraint (public clients that cannot hold a secret, no stored long-lived credential, no software on contractor laptops, least change for users, access cut within minutes, no cross-application correlation) and ask which design, validation check or control BEST meets it or what to do FIRST. Every option is usually a real, defensible control; the right one fixes the root cause at the right party (the relying party keeps authorization, the API checks audience and scope, the IdP pushes revocation) and at the right point in the flow, rather than hardening something the scenario does not depend on.

Other CCSP domains

Domain 1: Cloud Concepts, Architecture and Design17% of the exam · 269 questionsDomain 2: Cloud Data Security20% of the exam · 306 questionsDomain 3: Cloud Platform & Infrastructure Security17% of the exam · 252 questionsDomain 5: Cloud Security Operations17% of the exam · 258 questionsDomain 6: Legal, Risk and Compliance13% of the exam · 200 questionsAll CCSP practice questionsMixed sessions across all 6 domains — the way the real exam interleaves them.

Cloud Application Security: your questions

Cloud Application Security is domain 4 of the CCSP exam guide and carries 16% of the scored content — the 5th-heaviest of the 6 domains. On a 150-question paper that works out to roughly 24 questions, though ISC2 does not publish an exact per-domain count and individual exam forms vary.

Source

The domain weight and topic list on this page come from the official CCSP exam guide.